6.1Medium

CVE-2025-4054Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights

Relevanssi Relevanssi Premium; comesio Relevanssi – A Better Search Published: 2025-05-07 05:23 (1 year ago)

Description

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 (Free) and <= 2.27.4 (Premium), due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the search results.

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
comesio	Relevanssi – A Better Search	≤ 4.24.3
Relevanssi	Relevanssi Premium	≤ 2.27.4

References and patches

CVSS score

6.1Medium

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

All scores (2)

cna	CVSS 3.1	6.1Medium
security@wordfence.com	CVSS 3.1	6.1Medium

EPSS (chance of exploitation in 30 days)

0.41%

higher than 36% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-04-28
Published2025-05-07 05:23
Reached IP-DB2026-10-25 00:03
Last updated2026-06-17 12:32

Assigned by (CNA): Wordfence
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

8.8High

CVE-2026-13764 5 hours ago

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

StylemixThemes Masterstudy - Education WordPress Theme

The Masterstudy - Education WordPress Theme theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.151. This is due to missing authorization and nonce validation on the `masterstudy_ms_stm_set_discard_transient` AJ…

8.8High

CVE-2026-16135 5 hours ago

VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

VibeThemes VibeBP

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possibl…

8.8High

CVE-2026-15309 5 hours ago

CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

WishList Member CourseCure Courses

The CourseCure Courses plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.1. This is due to a missing capability check in the ajax_save_settings() function, which accepts arbitrary POST parameters and calls update…

5.4Medium

CVE-2026-2982 5 hours ago

WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'

wptb WP Table Builder – Drag & Drop Table Builder

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possib…

8.8High

CVE-2026-125836 9 hours ago

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

Nicu Micle Simple JWT Login

Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site Request Forgery.This issue affects Simple JWT Login: from n/a through 3.6.8.

5.3Medium

CVE-2026-124817 10 hours ago

Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

Clockinator Lite

The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave requests, allowing unauthenticated users to modify any leave record, including approving or rejecting requests and reassigning them to other users.